Uploading a Shell - OpenCart 12-08-2012, 05:31 AM
#1
The stories and information posted here are artistic works of fiction and falsehood. Only a fool would take anything posted here as fact.
| Uploading a Shell - OpenCart filter_list | |
![[Image: signature_third_eye.png]](http://i1183.photobucket.com/albums/x461/hack_man/signature_third_eye.png)
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
RE: Uploading a Shell - OpenCart 12-08-2012, 04:57 PM
#3
Nice, thanks for sharing. Even thought most difficult part was gaining access to admin panel.
Could you share with us how u did that? Reseted admin's password, and then brute-forced?
Could you share with us how u did that? Reseted admin's password, and then brute-forced?
RE: Uploading a Shell - OpenCart 12-18-2012, 08:15 PM
#6
(12-18-2012, 03:12 PM)vqoley Wrote:(12-08-2012, 04:57 PM)Faner Wrote: Nice, thanks for sharing. Even thought most difficult part was gaining access to admin panel.
Could you share with us how u did that? Reseted admin's password, and then brute-forced?
brute force take long time, use wordlist for short time.
Mate,
Quote: Reseted admin's password, and then brute-forced?see this? It means that first he resets password, then opencart use md5(rand()); and saves result as a code. Also that code is sent to admin's email. But since on windows rand() max value is something about 32k, he can make script with loop, try every counter from 1 to 32900 to encode in md5 and check if it's correct. To check whole 33k of possibilities could take up to few hours. And what wordlist would you advice in this case?
RE: Uploading a Shell - OpenCart 12-18-2012, 08:15 PM
#7
(12-18-2012, 03:12 PM)vqoley Wrote:(12-08-2012, 04:57 PM)Faner Wrote: Nice, thanks for sharing. Even thought most difficult part was gaining access to admin panel.
Could you share with us how u did that? Reseted admin's password, and then brute-forced?
brute force take long time, use wordlist for short time.
Mate,
Quote: Reseted admin's password, and then brute-forced?see this? It means that first he resets password, then opencart use md5(rand()); and saves result as a code. Also that code is sent to admin's email. But since on windows rand() max value is something about 32k, he can make script with loop, try every counter from 1 to 32900 to encode in md5 and check if it's correct. To check whole 33k of possibilities could take up to few hours. And what wordlist would you advice in this case?
